{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/lerc--4.1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:esri:lerc:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-10758"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LERC (\u003c= 4.1.0)"],"_cs_severities":["low"],"_cs_tags":["vulnerability","dos"],"_cs_type":"advisory","_cs_vendors":["Esri"],"content_html":"\u003cp\u003eThe Esri LERC (Limited Error Raster Compression) library, used for rapid encoding and decoding of image data, contains a heap-based out-of-bounds write vulnerability tracked as CVE-2026-10758. The flaw originates from an integer overflow during the processing of image data. An unauthenticated, remote attacker can exploit this by providing a specifically crafted image file to an application that utilizes an affected version of the LERC library (4.1.0 and earlier). Successful exploitation leads to an application crash, resulting in a denial of service. Because LERC is integrated into various geospatial and mapping applications to handle pixel data, this vulnerability impacts any downstream software relying on vulnerable versions for image decoding.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a denial-of-service risk to applications integrating the LERC library. In environments where these applications are mission-critical for geospatial analysis or infrastructure monitoring, an exploitation event can lead to significant service degradation and operational downtime.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all internal and vendor-supplied applications that include the LERC library as a dependency.\u003c/li\u003e\n\u003cli\u003eUpgrade instances of the LERC library to version 4.1.1 or later to remediate CVE-2026-10758.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for abnormal crashes or process terminations associated with the ingestion of external image or raster data.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-25T22:55:52Z","date_published":"2026-09-25T22:55:52Z","id":"https://feed.craftedsignal.io/briefs/2026-09-esri-lerc-overflow/","summary":"A heap-based out-of-bounds write vulnerability in Esri LERC versions 4.1.0 and earlier allows remote, unauthenticated attackers to cause a denial of service via crafted imagery.","title":"Heap-based Out-of-Bounds Write in Esri LERC","url":"https://feed.craftedsignal.io/briefs/2026-09-esri-lerc-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - LERC (\u003c= 4.1.0)","version":"https://jsonfeed.org/version/1.1"}